Skip to content
OpenAdvisories
Low · 3.1 CVE-2026-119126 EUVD-2026-113193GHSA-jqwm-2hj5-gmq3

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys

Published Oct 29, 2026 · Updated Oct 29, 2026 · Assigned by VulnCheck

Description

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates.

Affected products

VendorProductAffectedFixed
parse-community parse-server 9.0.0 – < 9.10.5-alpha.7, < 8.6.106 9.10.5-alpha.7

References